package SV_SCRIPT;

import javax.script.Invocable;
import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
import javax.servlet.http.HttpServletRequest;
import java.net.URL;

public class Vulnerable_01 {
    public static class MenuRenderer {

        public static void renderMenu(HttpServletRequest request) throws Exception {
            ScriptEngineManager manager = new ScriptEngineManager();
            ScriptEngine engine = manager.getEngineByName("JavaScript");

            //parameter "renderer" contains url of javascript rendering library
            URL url = new URL(request.getParameter("renderer"));
            engine.eval((String) url.getContent());

            Invocable inv = (Invocable) engine;

            // get script object on which we want to call the method
            Object menu = engine.get("menuRenderer");

            // invoke the method named "render" on the script object "obj"
            inv.invokeMethod(menu, "render", request.getParameter("menu"));
        }
    }
}
